# Red vs Blue (CTF challenge)

> An implant and its C2 traffic were pulled from a breached host — reverse them to reconstruct the intrusion.

Canonical: https://codelivly.com/ctf/challenges/red-vs-blue

| | |
|---|---|
| Category | Forensics & OSINT |
| Difficulty | Insane |
| Points | 6000 |
| Estimated time | 2 h |
| Type | Live instance |
| Solves | 27 |
| Author | Codelivly |

An implant and its C2 traffic were pulled from a breached host — reverse them to reconstruct the intrusion. Four tokens, one per phase: identify the attacker from the access log, recover the implant, reverse its XOR-obfuscated payload, then use the same key to decrypt the C2 beacon. Your own isolated instance; the tokens are unique to you. Submit each CLV{...}; capture all four to complete.

## Related

- [All CTF challenges](https://codelivly.com/practice?type=ctf)